Threat Library

A phishing campaign dubbed DEBULL abuses Microsoft's legitimate device-code authentication flow to hijack Microsoft 365 accounts, using collaboration-themed lures rather than fake login pages. Because the attack leverages the real Microsoft login experience and obtains valid OAuth tokens, it bypasses many traditional phishing detections and can persist beyond password resets. The campaign was active between late June and early July 2026, as reported by ZeroBEC.

Varonis researchers discovered a critical flaw in Google Dialogflow CX that allowed an attacker with edit access to one Code Block-enabled conversational agent to hijack other Code Block-enabled agents within the same Google Cloud project. Exploitation could expose live conversation data, steal user-shared information, and enable injection of attacker-controlled bot responses, including deceptive prompts to re-enter passwords. Google has since remediated the issue, but the flaw highlights significant multi-tenancy isolation risks in managed conversational AI platforms.

RedWing is a newly identified Android malware-as-a-service operation, rented out via Telegram for roughly $300/month, that allows low-skill attackers to take full control of victim devices, steal banking credentials, and intercept one-time passcodes (OTPs). Discovered by Zimperium's zLabs, it is believed to be a new variant of the Oblivion malware family, lowering the barrier of entry for widespread mobile banking fraud.

A hidden authentication backdoor has been discovered in multiple versions of Tenda router firmware, allowing attackers to gain unauthorized administrative access to the device's web management panel. This could enable full device takeover, traffic interception, and use of the router as a pivot point into internal networks.

Chinese state-linked threat actor UAT-7810 is deploying new malware dubbed LONGLEASH to expand an Operational Relay Box (ORB) network, primarily by compromising unpatched internet-facing Ruckus routers. The ORB network is used to anonymize and relay malicious traffic, complicating attribution and enabling downstream intrusion campaigns.

Accenture confirmed a security breach after a threat actor claimed to have stolen approximately 35 GB of source code and other internal data, subsequently offering it for sale on underground forums. As a major IT services and consulting provider, exposure of Accenture's internal source code and data poses downstream risk to its extensive client base across multiple industries.

Labcenter Proteus 9 (build 9.1_SP4_Build_42914), an electronic design automation tool used across critical infrastructure sectors, contains three high-severity memory corruption vulnerabilities including an out-of-bounds write, a stack-based buffer overflow, and a use-after-free. Successful exploitation requires local access and user interaction (e.g., opening a crafted file) but could lead to arbitrary code execution or information disclosure. No known public exploitation has been reported, and the vendor has released version 9.2 SPO to address the issues.

Hitachi Energy e-mesh EMS versions 4.1.6, 4.4.2, and 4.7.0 contain a heap-based buffer overflow vulnerability in the bundled NGINX ngx_http_rewrite_module (CVE-2026-42945), affecting NGINX v1.30.0 and below. Successful exploitation could crash the NGINX worker process (denial of service) and, under certain conditions where ASLR is disabled or bypassed, allow arbitrary code execution on the affected energy management system.

CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, including CVE-2026-55255, an authorization bypass in Langflow, a popular framework for building AI/LLM agent workflows. This is relevant to AI agent security because Langflow is used to construct agentic pipelines, and an authorization bypass could let attackers manipulate or hijack agent flows, credentials, or connected tools. The other two CVEs (JoomShaper and Joomlack) are unrelated CMS plugin vulnerabilities with no agentic relevance.

The WPFunnels WordPress plugin (versions up to 3.12.7) contains a critical unauthenticated RCE vulnerability caused by unsanitized handling of the 'postData' parameter, which allows attackers to inject PHP code into a log file that is later executed via include_once. With a CVSS score of 9.8, this flaw enables full server compromise on any WordPress site running the vulnerable plugin with logging enabled.

Traefik reverse proxy versions prior to v2.11.51, v3.6.22, and v3.7.6 fail to strip underscore-variant identity headers when using BasicAuth, DigestAuth, or ForwardAuth middlewares, allowing attackers to inject spoofed identity or authorization headers that backends normalize as legitimate. This enables authentication bypass and identity spoofing on any route protected by these middlewares, with a maximum CVSS score of 10.0 reflecting trivial exploitability and full compromise potential.

CVE-2026-9182 is an unrestricted file upload vulnerability in ArcGIS Server that allows an unauthenticated attacker to upload arbitrary crafted files to an affected endpoint. This could lead to further compromise such as web shell deployment or remote code execution depending on server configuration and processing of uploaded files.

A critical vulnerability (CVSS 9.9) in BeyondTrust Remote Support and Privileged Remote Access allows an authenticated, low-privileged attacker to bypass authorization checks and access data or resources outside their permitted scope. Because these platforms are widely used to broker privileged remote sessions, exploitation could enable lateral movement into sensitive infrastructure, including servers hosting automation and AI agent tooling.

A critical pre-authentication vulnerability in BeyondTrust Remote Support allows unauthenticated attackers to bypass access controls and gain unauthorized access, including to privileged accounts, when a specific authentication configuration is enabled. Given the 9.8 CVSS score and lack of authentication requirement, this flaw is highly likely to be weaponized quickly by opportunistic and targeted threat actors. Organizations using this remote support appliance should treat this as an urgent patching priority.

CVE-2026-48282 is a path traversal vulnerability in Adobe ColdFusion that can lead to arbitrary code execution in the context of the current user. It has been added to CISA's Known Exploited Vulnerabilities catalog with an aggressive three-day remediation window, indicating active exploitation in the wild.

Joomlack Page Builder, a Joomla CMS extension, contains an improper access control flaw that allows unauthenticated attackers to upload arbitrary files and achieve remote code execution. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild, with a remediation due date of July 10, 2026.

Langflow, a popular visual builder for LLM/agent workflows, has an authorization bypass that lets an authenticated user execute any other user's flow simply by supplying that victim's flow ID. This is a classic insecure direct object reference (IDOR) that fails to verify flow ownership before execution, allowing cross-tenant abuse in multi-user deployments. CISA has added it to the Known Exploited Vulnerabilities catalog, indicating active exploitation and urgency to patch.

CVE-2026-48908 is an unauthenticated arbitrary file upload vulnerability in JoomShaper SP Page Builder, a popular page-building extension for Joomla CMS. Attackers can upload and execute malicious PHP files without authentication, leading to full remote code execution on affected servers. The vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation in the wild.

This raw data is a routine blog post by Simon Willison announcing the release of sqlite-utils 4.0, describing new features like schema migrations, nested transactions, and compound foreign keys. There is no indication of any security vulnerability, prompt injection, agent compromise, or threat to AI agents or agent frameworks in this content.

9Router, a platform used to manage/orchestrate agent-related infrastructure, has a critical unauthenticated remote code execution flaw in its tunnel installation endpoint. An attacker can send a crafted 'sudoPassword' field that gets fed directly into a shell process, resulting in arbitrary OS command execution as root in many configurations. This is a classic infrastructure vulnerability with severe impact, already showing exploitation evidence in the wild.